redaxo

Records49All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

redaxo records in CISA KEV

No redaxo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Redaxo 31 records HIGH Redaxo Cms 1 record LOW

Records

31 records in Redaxo · all components

TI-2026-17559 CVE-2026-21857 · GHSA-824x-88xg-cwrv

Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

HIGH 69

REDAXO is a PHP-based content management system.

CVSS 4.0HIGH 8.3 Network High privileges No interaction EPSS 0.00535 Published 2026-01-07 Fixed in 5.20.2 CWE-22

TI-2025-39517 CVE-2025-64050 · GHSA-xj9j-gjxg-7jvq

A Remote Code Execution (RCE) vulnerability in the template management component in…

HIGH 67

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into a…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00973 Published 2025-11-25 Fixed in 5.20.1 CWE-94

TI-2024-30898 CVE-2024-46213 · GHSA-h6vc-pxj4-pcch

REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.

HIGH 67

REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01025 Published 2024-10-16 No fix listed

TI-2024-30896 CVE-2024-46210 · GHSA-cc53-v8jq-4w68

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1…

HIGH 67

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00585 Published 2025-01-10 No fix listed CWE-434

TI-2024-16680 CVE-2024-25301 · GHSA-vr7g-cxmj-9864

Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via…

HIGH 67

Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0148 Published 2024-02-14 No fix listed CWE-94

TI-2024-16678 CVE-2024-25298 · GHSA-7f2v-5877-rx3x

An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary…

HIGH 67

An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01108 Published 2024-02-17 No fix listed CWE-94

TI-2016-09229 CVE-2016-20053 · GHSA-2r3p-9jrg-pvg9

Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint

MEDIUM 64

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00152 Published 2026-04-04 No fix listed CWE-352

TI-2026-45001 CVE-2026-63000 · GHSA-m8r3-22v6-g877

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

MEDIUM 62

REDAXO is a PHP-based content management system.

CVSS 3.1MEDIUM 6.4 Network No auth User interaction EPSS 0.00149 Published 2026-09-23 Fixed in 5.21.2 CWE-352

TI-2025-40552 CVE-2025-66026 · GHSA-x6vr-q3vf-vqgq

REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

MEDIUM 60

REDAXO is a PHP-based CMS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00287 Published 2025-11-26 Fixed in 5.20.1 CWE-79

TI-2025-20247 CVE-2025-27412 · GHSA-8366-xmgf-334f

REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

MEDIUM 60

REDAXO is a PHP-based CMS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00287 Published 2025-03-05 Fixed in 5.18.3 CWE-79

TI-2025-20246 CVE-2025-27411 · GHSA-wppf-gqj5-fc4f

REDAXO allows Arbitrary File Upload in the mediapool page

MEDIUM 58

REDAXO is a PHP-based CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00281 Published 2025-03-05 Fixed in 5.18.3 CWE-434

TI-2024-30895 CVE-2024-46209 · GHSA-2p95-8xvm-2pjx

A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parame…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00425 Published 2025-01-06 No fix listed CWE-79

TI-2024-30897 CVE-2024-46212 · GHSA-37gm-h5wr-pf25

An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows…

MEDIUM 56

An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00866 Published 2024-10-16 No fix listed CWE-22

TI-2024-12255 CVE-2024-13209 · GHSA-7wj8-856p-qc9m

Redaxo CMS Structure Management Page index.php cross site scripting

MEDIUM 56

A vulnerability was found in Redaxo CMS 5.18.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.004 Published 2025-01-09 Fixed in 5.18.2 CWE-79

TI-2026-45003 CVE-2026-63002 · GHSA-w998-qmw9-mf4m

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

MEDIUM 55

REDAXO is a PHP-based content management system.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00197 Published 2026-09-23 Fixed in 5.21.2 CWE-79

TI-2025-39516 CVE-2025-64049 · GHSA-vqc7-7fj4-3fm3

A stored cross-site scripting (XSS) vulnerability in the module management component in…

MEDIUM 55

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00332 Published 2025-11-25 Fixed in 5.20.1 CWE-79

TI-2026-44999 CVE-2026-62998 · GHSA-4f5f-j737-pm58

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

MEDIUM 53

REDAXO is a PHP-based content management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00388 Published 2026-09-23 Fixed in 5.21.2 CWE-20

TI-2018-12675 CVE-2018-17831 · GHSA-m3rf-468q-xfmw

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the…

MEDIUM 46

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02053 Published 2018-10-01 No fix listed CWE-89

TI-2018-12873 CVE-2018-18200 · GHSA-mggx-323c-ww4g

There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.

MEDIUM 45

There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01421 Published 2018-10-09 No fix listed CWE-89

TI-2021-16768 CVE-2021-39459 · GHSA-w786-j2g7-7hq5

Remote code execution in the modules component in Yakamara Media Redaxo CMS version…

LOW 39

Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04894 Published 2021-09-09 No fix listed CWE-78

TI-2006-02753 CVE-2006-2845 · GHSA-qrqq-wjg5-gcm5

PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers…

LOW 39

PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to image_resize/pages/index.inc.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03836 Published 2006-06-06 No fix listed

TI-2006-02752 CVE-2006-2844 · GHSA-7jf5-vmvp-572g

Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers…

LOW 39

Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1) simple_user/pages/index.inc.php and (2) stats/page…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03836 Published 2006-06-06 No fix listed

TI-2006-02751 CVE-2006-2843 · GHSA-7j2r-xvcc-fpw7

PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to…

LOW 39

PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter in (a) addons/import_export/pages/index.inc.php and (b) pages…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03836 Published 2006-06-06 No fix listed

TI-2021-16767 CVE-2021-39458 · GHSA-wgx4-mfw2-ccw7

Triggering an error page of the import process in Yakamara Media Redaxo CMS version…

LOW 31

Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01191 Published 2021-09-09 No fix listed CWE-209

TI-2018-12872 CVE-2018-18199 · GHSA-786w-4844-w367

Mediamanager in REDAXO before 5.6.4 has XSS.

LOW 29

Mediamanager in REDAXO before 5.6.4 has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00829 Published 2018-10-09 No fix listed CWE-79

Open these records in search →